133 lines
5.3 KiB
Python
133 lines
5.3 KiB
Python
# Copyright 2014-present MongoDB, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you
|
|
# may not use this file except in compliance with the License. You
|
|
# may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
|
# implied. See the License for the specific language governing
|
|
# permissions and limitations under the License.
|
|
|
|
"""A fake SSLContext implementation."""
|
|
|
|
import ssl as _ssl
|
|
import sys as _sys
|
|
|
|
# PROTOCOL_TLS_CLIENT is Python 3.6+
|
|
PROTOCOL_SSLv23 = getattr(_ssl, "PROTOCOL_TLS_CLIENT", _ssl.PROTOCOL_SSLv23)
|
|
# Python 2.7.9+
|
|
OP_NO_SSLv2 = getattr(_ssl, "OP_NO_SSLv2", 0)
|
|
# Python 2.7.9+
|
|
OP_NO_SSLv3 = getattr(_ssl, "OP_NO_SSLv3", 0)
|
|
# Python 2.7.9+, OpenSSL 1.0.0+
|
|
OP_NO_COMPRESSION = getattr(_ssl, "OP_NO_COMPRESSION", 0)
|
|
# Python 3.7+, OpenSSL 1.1.0h+
|
|
OP_NO_RENEGOTIATION = getattr(_ssl, "OP_NO_RENEGOTIATION", 0)
|
|
|
|
# Python 2.7.9+
|
|
HAS_SNI = getattr(_ssl, "HAS_SNI", False)
|
|
IS_PYOPENSSL = False
|
|
|
|
# Base Exception class
|
|
SSLError = _ssl.SSLError
|
|
|
|
try:
|
|
# CPython 2.7.9+
|
|
from ssl import SSLContext
|
|
if hasattr(_ssl, "VERIFY_CRL_CHECK_LEAF"):
|
|
from ssl import VERIFY_CRL_CHECK_LEAF
|
|
# Python 3.7 uses OpenSSL's hostname matching implementation
|
|
# making it the obvious version to start using SSLConext.check_hostname.
|
|
# Python 3.6 might have been a good version, but it suffers
|
|
# from https://bugs.python.org/issue32185.
|
|
# We'll use our bundled match_hostname for older Python
|
|
# versions, which also supports IP address matching
|
|
# with Python < 3.5.
|
|
CHECK_HOSTNAME_SAFE = _sys.version_info[:2] >= (3, 7)
|
|
except ImportError:
|
|
from pymongo.errors import ConfigurationError
|
|
|
|
class SSLContext(object):
|
|
"""A fake SSLContext.
|
|
|
|
This implements an API similar to ssl.SSLContext from python 3.2
|
|
but does not implement methods or properties that would be
|
|
incompatible with ssl.wrap_socket from python 2.7 < 2.7.9.
|
|
|
|
You must pass protocol which must be one of the PROTOCOL_* constants
|
|
defined in the ssl module. ssl.PROTOCOL_SSLv23 is recommended for maximum
|
|
interoperability.
|
|
"""
|
|
|
|
__slots__ = ('_cafile', '_certfile',
|
|
'_keyfile', '_protocol', '_verify_mode')
|
|
|
|
def __init__(self, protocol):
|
|
self._cafile = None
|
|
self._certfile = None
|
|
self._keyfile = None
|
|
self._protocol = protocol
|
|
self._verify_mode = _ssl.CERT_NONE
|
|
|
|
@property
|
|
def protocol(self):
|
|
"""The protocol version chosen when constructing the context.
|
|
This attribute is read-only.
|
|
"""
|
|
return self._protocol
|
|
|
|
def __get_verify_mode(self):
|
|
"""Whether to try to verify other peers' certificates and how to
|
|
behave if verification fails. This attribute must be one of
|
|
ssl.CERT_NONE, ssl.CERT_OPTIONAL or ssl.CERT_REQUIRED.
|
|
"""
|
|
return self._verify_mode
|
|
|
|
def __set_verify_mode(self, value):
|
|
"""Setter for verify_mode."""
|
|
self._verify_mode = value
|
|
|
|
verify_mode = property(__get_verify_mode, __set_verify_mode)
|
|
|
|
def load_cert_chain(self, certfile, keyfile=None, password=None):
|
|
"""Load a private key and the corresponding certificate. The certfile
|
|
string must be the path to a single file in PEM format containing the
|
|
certificate as well as any number of CA certificates needed to
|
|
establish the certificate's authenticity. The keyfile string, if
|
|
present, must point to a file containing the private key. Otherwise
|
|
the private key will be taken from certfile as well.
|
|
"""
|
|
if password is not None:
|
|
raise ConfigurationError(
|
|
"Support for ssl_pem_passphrase requires "
|
|
"python 2.7.9+ (pypy 2.5.1+), python 3 or "
|
|
"PyOpenSSL")
|
|
self._certfile = certfile
|
|
self._keyfile = keyfile
|
|
|
|
def load_verify_locations(self, cafile=None, dummy=None):
|
|
"""Load a set of "certification authority"(CA) certificates used to
|
|
validate other peers' certificates when `~verify_mode` is other than
|
|
ssl.CERT_NONE.
|
|
"""
|
|
self._cafile = cafile
|
|
|
|
def wrap_socket(self, sock, server_side=False,
|
|
do_handshake_on_connect=True,
|
|
suppress_ragged_eofs=True, dummy=None):
|
|
"""Wrap an existing Python socket sock and return an ssl.SSLSocket
|
|
object.
|
|
"""
|
|
return _ssl.wrap_socket(sock, keyfile=self._keyfile,
|
|
certfile=self._certfile,
|
|
server_side=server_side,
|
|
cert_reqs=self._verify_mode,
|
|
ssl_version=self._protocol,
|
|
ca_certs=self._cafile,
|
|
do_handshake_on_connect=do_handshake_on_connect,
|
|
suppress_ragged_eofs=suppress_ragged_eofs)
|